External applications on a mainframe server.

[Peter Schober]

* Ed HOLT <ed.holt at syspertec.com> [2016-10-13 17:40]:
> What I would like to be able to do is to reverse proxy from the SP
> server through to the mainframe server once credentials have been
> validate and access the mainframe applications through the Virtel
> web server.

That's certainly possible, assuming you can make the proxied resource
look at the HTTP Request Headers you set on the proxy for
authorization purposes.
Also you'd want to make sure no direct access to the proxied resource
is possible, of course, side-stepping any security the proxy would
give you.

> <Location /virtel>
>   AuthType shibboleth
>   ShibRequestSetting requireSession 1
>   require shib-session
>   ProxyPass https://virtel.syspertec.com:41002/ connectiontimeout=10 timeout=30
>   ProxyPassReverse https://virtel.syspertec.com:41002/
> </location>         
> 
> When I access sp.syspertec.com/virtel I get the signin panel and
> provide my credentials to the idp. I am then redirected to the
> Virtel mainframe server.  Fiddler (http trace) shows a HTTP response
> is returned from the Virtel server. Unfortunately the URL is rooted
> to the local sp.syspertec.com. Any subsequent pages will not be
> found, they are not being served by the external server, but by the
> local SP server. I end up with a 404's.

If you can put up a HTML page or CGI script at /virtel at the proxy
and it works then that's all that concerns Shibboleth. The rest is
httpd configuration.
I don't follow your above error description, though. Are you saying
that you're staring at sp.syspertec.com/virtel and after the roundtrip
and HTTP POST'ing the SAML response to
sp.syspertec.com/Shibboleth.sso/... you're sent by the Shib IDP to
sp.syspertec.com/ instead of sp.syspertec.com/virtel ?

If so check the RelayState parameter and its values on its way to the
IDP and back from the IDP. Is it there in both cases, and is the value
unchanged?

It may just be the (common) case of proxy/pathA not matching
proxyied-resource/pathB which is purely an httpd configuration issue
that has nothing to do with Shibboleth.

To test put a static HTML (or plain text) page at
sp.syspertec.com/virtel and access it with a fresh browser (or newly
started private browing mode browser window). If you can access that
fine after SSO (to IDP and back) that's the end of Shib's involvement.
-peter